T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dscvr_api.py:62- Finding
Authenticated requests can be redirected to an arbitrary network destination
- Content
View full analysis
Any: """Make an authenticated GET request to the DSCVR API.""" url = f"{base_url}{path}" if params: params = {k: v for k, v in params.items() if v is not None} try: with httpx.Client(timeout=90.0) as client: response = client.get(url, headers=headers, params=params) ``` Authenticated POST requests have the same behavior: ```python def api_post(base_url: str, path: str, headers: dict[str, str], body: dict[str, Any] | None = None) -> Any: """Make an authenticated POST request to the DSCVR API.""" url = f"{base_url}{path}" if body: body = {k: v for k, v in body.items() if v is not None} try: with httpx.Client(timeout=90.0) as client: response = client.post(url, headers={**headers, "Content-Type": "application/json"}, json=body or {}) ``` The corresponding signature is not bound to the request method, destination, path, query parameters, or body: ```python def compute_signature(secret_key: str, api_key: str, timestamp: str) -> str: message = f"{api_key}:{timestamp}".encode() return hmac.new(secret_key.encode(), message, hashlib.sha256).hexdigest() ``` ### Technical Analysis The Skill needs network access and authenticated DSCVR requests for its declared functionality. Sending an AP ...[truncated 3086 chars]- Remediation
View remediation